8. Identity Theft

Striking the right balance between caution and paranoia can be tough when it comes to identity theft.

Identity thieves victimized more than 11 million Americans in 2011, according to Javelin Research, which conducts an annual ID theft survey. Much of the theft consisted of credit card fraud, which is relatively easy to overcome—you report the fraud, get a new account number, and move on. More worrisome is new account fraud, in which the bad guys take on your identity and open new accounts in your name. That type of fraud can go on for years and can be a bear to fight.

What’s worse, much of your risk is beyond your control. Your personal identifying information is kept in many huge databases with questionable security. As of this writing, more than 500 million records have been exposed in more than 3,000 database breaches, according to the Privacy Rights Clearinghouse, which has tracked such breaches since 2005. The Javelin survey found that people whose information had been exposed in database breaches were nearly ten times more likely to become the victims of identity theft.

You can take actions to reduce your risk, but you still need to be vigilant.

A: You’ve learned a couple lessons, foremost among them that you need a new tax pro. Filing your return without letting you see it was a definite nono.

Another lesson is that you probably shouldn’t entrust your private financial data to the U.S. mail system. Although this is common, it’s certainly not secure, since such mailings aren’t tracked and they certainly aren’t encrypted. It’s much safer to drop off your documents with your tax preparer and pick them up yourself, along with a copy of your return, when he or she is done. The original return can be electronically filed using the IRS’s encrypted system, eliminating the need to use the mail.

You can put 90-day fraud alerts on your credit reports at the three major bureaus (Experian, Equifax, and TransUnion). Fraud alerts notify lenders that they should take extra steps to verify identity before opening accounts in your name. For more protection, you may want to consider a credit freeze, which doesn’t rely on lenders’ sometimes-wavering vigilance, but allows you to shut off access to your credit reports, preventing thieves from opening new credit accounts. For more information, visit Consumers Union at http://tinyurl.com/z7mc8.

A: You’re smart to be careful with your Social Security number, but if you want this company’s service, you’ll probably have to cough up the number.

Lenders are not the only businesses that want to check your creditworthiness before they’ll do business with you. Cellphone carriers, landlords, utilities, and employers often want a look at your credit reports or credit scores as well. Some states have passed laws restricting how credit information is used in certain circumstances, but in many cases, individuals have just two choices: comply with the request for Social Security numbers or don’t do business with these companies.

That’s not to say you should hand out your number to any business that asks. If the business isn’t establishing a credit relationship with you and isn’t in financial services—which are required to have your Social Security number to report tax information to the IRS—you should find out why they’re asking for the number and consider declining.

Here’s what the Social Security Administration has to say about businesses asking for your Social Security number: “Giving your SSN is voluntary, even when you are asked for the number directly. If requested, you should ask why your SSN is needed, how your number will be used, what law requires you to give your number and what the consequences are if you refuse. The answers to these questions can help you decide if you want to give your Social Security number. The decision is yours.”

A: Run, don’t walk, to your computer and point your browser to the free credit report site, www.annualcreditreport.com. (This is the only address to use; beware of fake and look-alike sites.)

You need to check your reports to see if an identity thief has hijacked your good name. Although many issuers are closing inactive accounts and raising interest rates for broad swaths of their customers, most aren’t referring to nonexistent debt as the reason to do so.

If you discover credit accounts or collections that aren’t yours, you’ll need to file a police report and dispute the errors with the credit bureaus. The Identity Theft Resource Center at www.idtheftcenter.org has fact sheets and other helpful information to guide you through this process.

If you have been the victim of identity theft, you should at least put fraud alerts on your reports at the three bureaus and consider freezing your credit. A fraud alert signals to lenders that they need to verify the identity of anyone trying to open an account in your name. A credit freeze prevents the lender from accessing your credit reports, which should halt new credit accounts altogether unless you “unlock” the report in advance. Again, the Identity Theft Resource Center has more information.

If you don’t spot any obvious problems, it could be that the retailer was using outdated information. You can ask it to reconsider its decision, although most issuers are reluctant to reopen accounts after they’re closed.

If you’re concerned about further account closures, simply use one or two of your cards to make small purchases each month and pay off the balances in full. This should prevent further account closures.

A: New Social Security numbers wouldn’t necessarily protect you from identity theft and could create additional complications.

Thieves might still be able to use your old numbers to establish new accounts, and those fraudulent accounts could show up in your credit reports. If for some reason the credit bureaus didn’t combine the records for your old and new numbers, you could be left without any credit history at all, which could make getting future credit difficult.

The Identity Theft Resource Center, which advises victims on this issue, typically doesn’t recommend applying for new numbers. Instead, it suggests credit freezes, which prevent most lenders from viewing your credit reports or establishing new accounts without your consent.

Credit freezes aren’t foolproof: Some lenders don’t check with credit bureaus before opening accounts. Credit freezes also don’t prevent a thief from using your Social Security numbers to commit health care fraud or criminal identity theft (when a thief pretends to be you when he or she is arrested). Also, freezing and unfreezing your credit reports may involve fees.

But credit freezes are probably your best defense at this point, before you’ve been victimized. You can learn more about credit freezes at the Identity Theft Center’s site, www.idtheftcenter.org.

A: You mother should put credit freezes in place immediately, as should you and the rest of your family. A credit freeze can prevent others from opening credit accounts in your name and is a much stronger protection than the fraud alerts credit bureaus typically recommend.

A family member who has stolen one person’s identity could well steal the identities of others because she probably knows the essential details—names, Social Security numbers, dates of birth, and addresses—that would allow her to commit more of these crimes.

You seem to understand that, to avoid responsibility for this debt, your mother almost certainly will need to file a police report, which means your sister could be prosecuted and sent to jail.

Occasionally, lenders will let a victim off the hook without such a report if the thief admits the deed, commits to making payments, and has the means to do so, says Linda Foley, cofounder of San Diego’s Identity Theft Resource Center, which helps victims of this kind of fraud. The family typically needs to hire a lawyer to conduct such negotiations and draw up the necessary paperwork, Foley says. It doesn’t sound like your sister is a great candidate for this kind of deal, however, unless she has gotten her act more together than your letter indicates.

Your best move now, after recommending credit freezes for your family members, is to point your parents to the Identity Theft Resource Center, which has resources for victims of familial identity theft. Then back off. This is your parents’ decision to make.

A: If she hasn’t done so already, your wife should call the police to report the crime and get a copy of the report, in case she needs it later to prove she’s a victim of identity theft.

Your wife is the one who needs to have fraud alerts placed on her credit reports at all three of the major credit bureaus: Equifax, at (800) 525-6285; Experian, at (888) 397-3742; and TransUnion, at (800) 680-7289. These alerts are good for 90 days and can be renewed. It’s unfortunate that the bureaus are using these help lines to pitch products, but you don’t need to buy anything to get a fraud alert placed on your files. In two or three months, your wife should use www.annualcreditreport.com to get a free look at her credit reports to make sure no one has opened accounts in her name.

She also may want to consider a credit freeze, which locks up her credit reports to make it much harder for someone to apply for credit in her name. In addition, she needs to call your state’s department of motor vehicles to report the stolen license. If she discovers later that someone is using it, she can request a number change.

For more on coping with stolen information and dealing with identity theft, visit the Identity Theft Resource Center, at www.idtheftcenter.org.

In addition, my husband had a lot of annuities and 457 deferred compensation plans, which were converted to additional service credit on his pension or rolled over into IRAs before he died. Can I shred the statements for those? They go back 20 years! Can I shred most of those old canceled checks? All the pay stubs? The really old tax returns? Help!

A: First of all, condolences on your loss. And I’m especially sorry you have to sort through such a mound of paperwork while you grieve.

Indeed, some scam artists target the identities of the recently deceased. That’s one of the reasons it’s important for the executor of an estate to inform all the deceased person’s creditors of the death. Typically, the creditors relay that information to the credit bureaus. The bureaus also consult a death list maintained by the Social Security Administration, although it often takes a few months for a name to show up on that list.

In any case, you’ll probably want to pull your husband’s credit reports from the three bureaus (Equifax, Experian, and TransUnion) to see whether he’s properly listed as deceased; if not, request that the notation be added.

Most of the time, being listed as dead shuts off opportunities for identity theft, as many people who’ve been incorrectly listed this way will attest. (Some people have found themselves with “deceased” notations on their credit reports after a joint account holder died and the creditors reported the information incorrectly to the bureaus.)

But you still want to be careful about handling any paperwork that has private personal information on it. When in doubt, shred. Given the amount of paperwork you need to process, you might consider hiring a professional shredding service that can come to your house and zip through your piles in a matter of minutes. (A local accountant, bank, or mortgage lender may be able to provide you a referral.)

For guidance on what you need to keep, I consulted John W. Roth, senior federal tax analyst for tax research firm CCH Inc. “Generally, all the [canceled] checks can be shredded except for those that are needed to substantiate deductions on their tax returns for the last three years,” Roth says. “Keep the W-2 and 1099 statements that relate to the last three years of tax returns.”

Roth recommends that you hang on to older tax returns as well, although you can shred any accompanying documentation. You may need to keep the annuity and 457 paperwork as well, since those can help establish how much of your husband’s (and now your) retirement benefits are taxable. Consult a tax pro for details. You also might want to consult a professional—in this case, an estate planning attorney—about whether to keep any of your in-laws’ documents.

A: The only silver lining about the identity theft epidemic is that plenty of resources have sprung up to help the victims.

Your stepson still has a lot of work ahead of him. He can turn to others for education and information, but he’s the one who needs to contact the credit bureaus, file a police report, and take the other steps necessary to clear his name.

He can’t expect anyone else to do the work for him, and he’ll be lucky if any official investigation is conducted. Most police departments place a pretty low priority on identity crimes, and research firm Gartner has estimated that the thieves face only a 1-in-700 chance of being caught.

But your stepson can limit the damage. He can get information from the FTC by visiting its consumer Web site, www.ftc.gov/idtheft.

He also can check out the Identity Theft Resource Center (at www.idtheftcenter.org), a nonprofit organization that won a National Crime Victim Service Award from the Department of Justice.

A: More than half the states have banned the use of Social Security numbers on health insurance cards, but those laws don’t apply to the federal Medicare program. Unless Congress acts to change the federal law, you’re stuck with having your Social Security number as your Medicare identifier.

The Privacy Rights Clearinghouse recommends that you protect yourself from identity theft by making a copy of your Medicare card and using a black marker to cross out the last four digits of your Social Security number, or cutting out the last digits with scissors. That way, if your wallet is stolen, the thief doesn’t have access to your full number. You would still need to bring your original card the first time you visit any new health care provider, but you wouldn’t have to carry it with you all the time.

A: You’ve pointed out another problem with using Social Security numbers as an all-purpose identifier. Federal and state laws require businesses that collect Social Security numbers to protect that information. But the fact remains that the more entities have your number, the more vulnerable you may be to identity theft.

As an individual, you’re unlikely to change the IRS’s mind about the necessity of collecting this information. But when you’re asked for your Social Security or tax ID number, it’s fair to ask the requester how your information will be protected. That at least puts the requester on notice that you expect the laws regarding the safeguarding of personal information to be followed.